PT-2023-28198 · Unknown · Dolibarr Erp/Crm

Chocologicall + 1 · Publicado 2023-11-01 · Atualizado 2025-04-03 · CVE-2023-4197

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions <= 18.0.1

Description The issue is related to improper input validation, which fails to strip certain PHP code from user-supplied input when creating a Website. This allows an attacker to inject and evaluate arbitrary PHP code. Approximately 13,472 devices are potentially affected, mainly distributed in France, the United States, and other countries.

Recommendations For Dolibarr ERP CRM versions <= 18.0.1, update to a version higher than 18.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the Website creation feature to minimize the risk of exploitation. Avoid using user-supplied input in the creation of Websites until the issue is resolved.

Correção

Special Elements Injection

RCE

Enumeração de Fraquezas

CWE-74

CWE-20

Identificadores relacionados

BIT-DOLIBARR-2023-4197

CVE-2023-4197

GHSA-R9CM-PW9J-3FPX

Produtos afetados

Dolibarr Erp/Crm

Referências · 15

• https://github.com/Dolibarr/dolibarr · Nota
• https://github.com/Dolibarr/dolibarr/commit/0ed6a63fb06be88be5a4f8bcdee83185eee4087e · Correção
• https://osv.dev/vulnerability/CVE-2023-4197 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r9cm-pw9j-3fpx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4197 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-4197 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1719663907873214665 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1719630213196181722 · Publicação no Twitter
• https://twitter.com/starlabs_sg/status/1719700025700483280 · Publicação no Twitter
• https://twitter.com/zoomeye_team/status/1719657823246885221 · Publicação no Twitter
• https://t.me/cibsecurity/73302 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-4197 · Aviso do Fabricante
• https://starlabs.sg/advisories/23/23-4197 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4197 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-dolibarr-2023-4197 · Aviso do Fabricante